mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-15 18:33:43 +00:00
Merge branch 'master' into tvm-server
This commit is contained in:
Beth Levin
@ -1204,19 +1204,19 @@ The following list shows the supported values:
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>6</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>6</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>6</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>6</sup></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -1234,7 +1234,7 @@ The following list shows the supported values:
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
|
||||
Added in Windows 10, version 1709. Allows IT admins to specify the number of days a user has before feature updates are installed on their devices automatically. Updates and restarts will occur regardless of active hours and the user will not be able to reschedule.
|
||||
Added in Windows 10, version 1903. Also available in Windows 10, versions 1809, 1803, and 1709. Allows IT admins to specify the number of days a user has before feature updates are installed on their devices automatically. Updates and restarts will occur regardless of active hours and the user will not be able to reschedule.
|
||||
<!--/Description-->
|
||||
<!--ADMXMapped-->
|
||||
ADMX Info:
|
||||
@ -1275,19 +1275,19 @@ Default value is 7.
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>6</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>6</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>6</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>6</sup></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -1305,7 +1305,7 @@ Default value is 7.
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
|
||||
Added in Windows 10, version 1709. Allows IT admins to specify the number of days a user has before quality updates are installed on their devices automatically. Updates and restarts will occur regardless of active hours and the user will not be able to reschedule.
|
||||
Added in Windows 10, version 1903. Also available in Windows 10, versions 1809, 1803, and 1709. Allows IT admins to specify the number of days a user has before quality updates are installed on their devices automatically. Updates and restarts will occur regardless of active hours and the user will not be able to reschedule.
|
||||
<!--/Description-->
|
||||
<!--ADMXMapped-->
|
||||
ADMX Info:
|
||||
@ -1346,19 +1346,19 @@ Default value is 7.
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>6</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>6</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>6</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>6</sup></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -1376,7 +1376,7 @@ Default value is 7.
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
|
||||
Added in Windows 10, version 1709. Allows the IT admin (when used with [Update/ConfigureDeadlineForFeatureUpdates](#update-configuredeadlineforfeatureupdates) or [Update/ConfigureDeadlineForQualityUpdates](#update-configuredeadlineforqualityupdates)) to specify a minimum number of days until restarts occur automatically. Setting the grace period may extend the effective deadline set by the deadline policies.
|
||||
Added in Windows 10, version 1903. Also available in Windows 10, versions 1809, 1803, and 1709. Allows the IT admin (when used with [Update/ConfigureDeadlineForFeatureUpdates](#update-configuredeadlineforfeatureupdates) or [Update/ConfigureDeadlineForQualityUpdates](#update-configuredeadlineforqualityupdates)) to specify a minimum number of days until restarts occur automatically. Setting the grace period may extend the effective deadline set by the deadline policies.
|
||||
|
||||
<!--/Description-->
|
||||
<!--ADMXMapped-->
|
||||
@ -1418,19 +1418,19 @@ Default value is 2.
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Pro</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>6</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Business</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>6</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Enterprise</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>6</sup></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Education</td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>3</sup></td>
|
||||
<td><img src="images/checkmark.png" alt="check mark" /><sup>6</sup></td>
|
||||
</tr>
|
||||
</table>
|
||||
|
||||
@ -1448,7 +1448,7 @@ Default value is 2.
|
||||
<!--/Scope-->
|
||||
<!--Description-->
|
||||
|
||||
Added in Windows 10, version 1709. If enabled (when used with [Update/ConfigureDeadlineForFeatureUpdates](#update-configuredeadlineforfeatureupdates) or [Update/ConfigureDeadlineForQualityUpdates](#update-configuredeadlineforqualityupdates)), devices will not automatically restart outside of active hours until the deadline is reached, even if applicable updates are already installed and pending a restart.
|
||||
Added in Windows 10, version 1903. Also available in Windows 10, versions 1809, 1803, and 1709. If enabled (when used with [Update/ConfigureDeadlineForFeatureUpdates](#update-configuredeadlineforfeatureupdates) or [Update/ConfigureDeadlineForQualityUpdates](#update-configuredeadlineforqualityupdates)), devices will not automatically restart outside of active hours until the deadline is reached, even if applicable updates are already installed and pending a restart.
|
||||
|
||||
When disabled, if the device has installed the required updates and is outside of active hours, it may attempt an automatic restart before the deadline.
|
||||
<!--/Description-->
|
||||
|
||||
@ -20,7 +20,7 @@ ms.topic: article
|
||||
> [!IMPORTANT]
|
||||
> While [Windows Analytics was retired on January 31, 2020](https://docs.microsoft.com/windows/deployment/update/update-compliance-monitor), support for Update Compliance has continued through the Azure Portal; however, please note the following updates:
|
||||
>
|
||||
> * On March 31, 2020, the Windows Defender Antivirus reporting feature of Update Compliance will be removed. You can continue to define and review security compliance policies using [Microsoft Endpoint Manager](https://docs.microsoft.com/configmgr/), which allows finer control over security features and updates.
|
||||
> * On March 31, 2020, the Windows Defender Antivirus reporting feature of Update Compliance will be removed. You can continue to define and review security compliance policies using [Microsoft Endpoint Manager](https://www.microsoft.com/microsoft-365/microsoft-endpoint-manager), which allows finer control over security features and updates.
|
||||
> * The Perspectives feature of Update Compliance will also be removed on March 31, 2020 in favor of a better experience. The Perspectives feature is part of the Log Search portal of Log Analytics, which was deprecated on February 15, 2019 in favor of [Azure Monitor Logs](https://docs.microsoft.com/azure/azure-monitor/log-query/log-search-transition). Your Update Compliance solution will be automatically upgraded to Azure Monitor Logs, and the data available in Perspectives will be migrated to a set of queries in the [Needs Attention section](update-compliance-need-attention.md) of Update Compliance.
|
||||
|
||||
|
||||
|
||||
@ -18,7 +18,7 @@ ms.topic: article
|
||||
|
||||
|
||||
> [!IMPORTANT]
|
||||
> On March 31, 2020, the Windows Defender Antivirus reporting feature of Update Compliance will be removed. You can continue to define and review security compliance policies using [Microsoft Endpoint Manager](https://docs.microsoft.com/configmgr/), which allows finer control over security features and updates.
|
||||
> On March 31, 2020, the Windows Defender Antivirus reporting feature of Update Compliance will be removed. You can continue to define and review security compliance policies using [Microsoft Endpoint Manager](https://www.microsoft.com/microsoft-365/microsoft-endpoint-manager), which allows finer control over security features and updates.
|
||||
|
||||
|
||||
|
||||
|
||||
@ -89,7 +89,7 @@ For Microsoft customers that do not have EA or MPSA, you can obtain Windows 10 E
|
||||
|
||||
If devices are running Windows 7 or Windows 8.1, see [New Windows 10 upgrade benefits for Windows Cloud Subscriptions in CSP](https://blogs.windows.com/business/2017/01/19/new-windows-10-upgrade-benefits-windows-cloud-subscriptions-csp/)
|
||||
|
||||
#### Muti-factor authentication
|
||||
#### Multi-factor authentication
|
||||
|
||||
An issue has been identified with Hybrid Azure AD joined devices that have enabled [multi-factor authentication](https://docs.microsoft.com/azure/active-directory/authentication/howto-mfa-getstarted) (MFA). If a user signs into a device using their Active Directory account and MFA is enabled, the device will not successfully upgrade to their Windows Enterprise subscription.
|
||||
|
||||
|
||||
@ -26,6 +26,9 @@ ms.topic: article
|
||||
<table>
|
||||
<th>Issue<th>More information
|
||||
|
||||
<tr><td>Windows Autopilot user-driven Hybrid Azure AD deployments do not grant users Administrator rights even when specified in the Windows Autopilot profile.</td>
|
||||
<td>This will occur when there is another user on the device that already has Administrator rights. For example, a PowerShell script or policy could create an additional local account that is a member of the Administrators group. To ensure this works properly, do not create an additional account until after the Windows Autopilot process has completed.</tr>
|
||||
|
||||
<tr><td>Windows Autopilot device provisioning can fail with TPM attestation errors or ESP timeouts on devices where the real-time clock is off by a significant amount of time (e.g. several minutes or more).</td>
|
||||
<td>To fix this issue: <ol><li>Boot the device to the start of the out-of-box experience (OOBE).
|
||||
<li>Establish a network connection (wired or wireless).
|
||||
|
||||
@ -23,6 +23,10 @@ ms.date: 9/10/2019
|
||||
|
||||
This article describes the network connections that Windows 10 components make to Microsoft and the Mobile Device Management/Configuration Service Provider (MDM/CSP) and custom Open Mobile Alliance Uniform Resource Identifier ([OMA URI](https://docs.microsoft.com/intune/custom-settings-windows-10)) policies available to IT Professionals using Microsoft Intune to help manage the data shared with Microsoft. If you want to minimize connections from Windows to Microsoft services, or configure privacy settings, there are a number of settings for consideration. For example, you can configure diagnostic data to the lowest level for your edition of Windows and evaluate other connections Windows makes to Microsoft services you want to turn off using the instructions in this article. While it is possible to minimize network connections to Microsoft, there are many reasons why these communications are enabled by default, such as updating malware definitions and maintaining current certificate revocation lists. This data helps us deliver a secure, reliable, and up-to-date experience.
|
||||
|
||||
Note: The 1903 settings in the Windows Restricted Traffic Limited Functionality Baseline package are applicable to 1909 Windows Enterprise devices.
|
||||
|
||||
Note: If a user executes the "Reset this PC" command (Settings -> Update & Security -> Recovery) with the "Keep my files" option the Windows Restricted Traffic Limited Functionality Baseline settings will need to be re-applied to in order re-restrict the device. Also, egress traffic may occur during the period leading up to the re-applications of the Restricted Traffic Limited Functionality Baseline settings.
|
||||
|
||||
>[!IMPORTANT]
|
||||
>- The Allowed Traffic endpoints for an MDM configuration are here: [Allowed Traffic](#bkmk-mdm-allowedtraffic)
|
||||
> - CRL (Certificate Revocation List) and OCSP (Online Certificate Status Protocol) network traffic cannot be disabled and will still show up in network traces. CRL and OCSP checks are made to the issuing certificate authorities. Microsoft is one of these authorities. There are many others such as DigiCert, Thawte, Google, Symantec, and VeriSign.
|
||||
|
||||
@ -31,7 +31,7 @@ ms.topic: conceptual
|
||||
</tr>
|
||||
<tr>
|
||||
<td colspan="7">
|
||||
<a href="#apis"><center><b>Centratlized configuration and administration, APIs</a></b></center></td>
|
||||
<a href="#apis"><center><b>Centralized configuration and administration, APIs</a></b></center></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td colspan="7"><a href="#mtp"><center><b>Microsoft Threat Protection</a></center></b></td>
|
||||
@ -42,9 +42,9 @@ ms.topic: conceptual
|
||||
<a name="tvm"></a>
|
||||
|
||||
**[Threat & Vulnerability Management](microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md)**<br>
|
||||
This built-in capability uses a game-changing risk-based approach to the discovery, prioritization, and remediation of endpoint vulnerabilities and misconfigurations.
|
||||
This built-in capability uses a game-changing risk-based approach to the discovery, prioritization, and remediation of endpoint vulnerabilities and misconfigurations.
|
||||
|
||||
- [Risk-based Threat & Vulnerability Management](microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md)
|
||||
- [Risk-based Threat & Vulnerability Management](microsoft-defender-atp/next-gen-threat-and-vuln-mgt.md)
|
||||
- [Supported operating systems and platforms](microsoft-defender-atp/tvm-supported-os.md)
|
||||
- [What's in the dashboard and what it means for my organization](microsoft-defender-atp/tvm-dashboard-insights.md)
|
||||
- [Exposure score](microsoft-defender-atp/tvm-exposure-score.md)
|
||||
@ -97,7 +97,7 @@ Endpoint detection and response capabilities are put in place to detect, investi
|
||||
<a name="ai"></a>
|
||||
|
||||
**[Automated investigation and remediation](microsoft-defender-atp/automated-investigations.md)**<br>
|
||||
In conjunction with being able to quickly respond to advanced attacks, Microsoft Defender ATP offers automatic investigation and remediation capabilities that help reduce the volume of alerts in minutes at scale.
|
||||
In conjunction with being able to quickly respond to advanced attacks, Microsoft Defender ATP offers automatic investigation and remediation capabilities that help reduce the volume of alerts in minutes at scale.
|
||||
|
||||
- [Automated investigation and remediation](microsoft-defender-atp/automated-investigations.md)
|
||||
- [View details and results of automated investigations](microsoft-defender-atp/auto-investigation-action-center.md)
|
||||
@ -116,7 +116,7 @@ Microsoft Defender ATP includes a configuration score to help you dynamically as
|
||||
<a name="mte"></a>
|
||||
|
||||
**[Microsoft Threat Experts](microsoft-defender-atp/microsoft-threat-experts.md)**<br>
|
||||
Microsoft Defender ATP's new managed threat hunting service provides proactive hunting, prioritization and additional context and insights that further empower Security Operation Centers (SOCs) to identify and respond to threats quickly and accurately.
|
||||
Microsoft Defender ATP's new managed threat hunting service provides proactive hunting, prioritization and additional context and insights that further empower Security Operation Centers (SOCs) to identify and respond to threats quickly and accurately.
|
||||
|
||||
- [Targeted attack notification](microsoft-defender-atp/microsoft-threat-experts.md)
|
||||
- [Experts-on-demand](microsoft-defender-atp/microsoft-threat-experts.md)
|
||||
@ -139,7 +139,7 @@ Integrate Microsoft Defender Advanced Threat Protection into your existing workf
|
||||
- Office 365 ATP
|
||||
- Azure ATP
|
||||
- Azure Security Center
|
||||
- Skype for Business
|
||||
- Skype for Business
|
||||
- Microsoft Cloud App Security
|
||||
|
||||
<a name="mtp"></a>
|
||||
|
||||
@ -26,6 +26,8 @@ Conducting a comprehensive security product evaluation can be a complex process
|
||||
The Microsoft Defender ATP evaluation lab is designed to eliminate the complexities of machine and environment configuration so that you can
|
||||
focus on evaluating the capabilities of the platform, running simulations, and seeing the prevention, detection, and remediation features in action.
|
||||
|
||||
> [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4qLUM]
|
||||
|
||||
When you get started with the lab, you'll be guided through a simple set-up process where you can specify the type of configuration that best suits your needs.
|
||||
|
||||
After the lab setup process is complete, you can add Windows 10 or Windows Server 2019 machines. These test machines come pre-configured to have the latest and greatest OS versions with the right security components in place and Office 2019 Standard installed.
|
||||
|
||||
@ -30,6 +30,9 @@ When you investigate an incident, you'll see:
|
||||
- Incident comments and actions
|
||||
- Tabs (alerts, machines, investigations, evidence, graph)
|
||||
|
||||
> [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4qLUV]
|
||||
|
||||
|
||||
## Analyze incident details
|
||||
Click an incident to see the **Incident pane**. Select **Open incident page** to see the incident details and related information (alerts, machines, investigations, evidence, graph).
|
||||
|
||||
|
||||
@ -1,123 +0,0 @@
|
||||
---
|
||||
title: Validate licensing provisioning and complete Microsoft Defender ATP set up
|
||||
description: Validating licensing provisioning, setting up initial preferences, and completing the user set up for Microsoft Defender Advanced Threat Protection portal.
|
||||
keywords: license, licensing, account, set up, validating licensing, windows defender atp
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
search.appverid: met150
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.author: macapara
|
||||
author: mjcaparas
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: article
|
||||
---
|
||||
|
||||
# Validate licensing provisioning and complete set up for Microsoft Defender ATP
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559)
|
||||
|
||||
|
||||
>Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp?ocid=docs-wdatp-validatelicense-abovefoldlink)
|
||||
|
||||
## Check license state
|
||||
|
||||
Checking for the license state and whether it got properly provisioned, can be done through the admin center or through the **Microsoft Azure portal**.
|
||||
|
||||
1. To view your licenses go to the **Microsoft Azure portal** and navigate to the [Microsoft Azure portal license section](https://portal.azure.com/#blade/Microsoft_AAD_IAM/LicensesMenuBlade/Products).
|
||||
|
||||
|
||||
|
||||
1. Alternately, in the admin center, navigate to **Billing** > **Subscriptions**.
|
||||
|
||||
- On the screen you will see all the provisioned licenses and their current **Status**.
|
||||
|
||||
|
||||
|
||||
|
||||
## Cloud Service Provider validation
|
||||
|
||||
To gain access into which licenses are provisioned to your company, and to check the state of the licenses, go to the admin center.
|
||||
|
||||
1. From the **Partner portal**, click on the **Administer services > Office 365**.
|
||||
|
||||
2. Clicking on the **Partner portal** link will leverage the **Admin on behalf** option and will give you access to the customer admin center.
|
||||
|
||||
|
||||
|
||||
## Access Microsoft Defender Security Center for the first time
|
||||
|
||||
When accessing [Microsoft Defender Security Center](https://SecurityCenter.Windows.com) for the first time there will be a setup wizard that will guide you through some initial steps. At the end of the setup wizard there will be a dedicated cloud instance of Microsoft Defender ATP created.
|
||||
|
||||
1. Each time you access the portal you will need to validate that you are authorized to access the product. This **Set up your permissions** step will only be available if you are not currently authorized to access the product.
|
||||
|
||||
|
||||
|
||||
Once the authorization step is completed, the **Welcome** screen will be displayed.
|
||||
|
||||
2. The **Welcome** screen will provide some details as to what is about to occur during the set up wizard.
|
||||
|
||||
|
||||
|
||||
You will need to set up your preferences for Microsoft Defender Security Center.
|
||||
|
||||
3. Set up preferences
|
||||
|
||||
|
||||
|
||||
1. **Select data storage location** <br> When onboarding the service for the first time, you can choose to store your data in the Microsoft Azure datacenters in the United States, the European Union, or the United Kingdom. Once configured, you cannot change the location where your data is stored. This provides a convenient way to minimize compliance risk by actively selecting the geographic locations where your data will reside. Microsoft will not transfer the data from the specified geolocation.
|
||||
|
||||
> [!WARNING]
|
||||
> This option cannot be changed without completely offboarding from Microsoft Defender ATP and completing a new enrollment process.
|
||||
|
||||
2. **Select the data retention policy** <br> Microsoft Defender ATP will store data up to a period of 6 months in your cloud instance, however, you have the option to set the data retention period for a shorter timeframe during this step of the set up process.
|
||||
|
||||
> [!NOTE]
|
||||
> This option can be changed at a later time.
|
||||
|
||||
3. **Select the size of your organization** <br> You will need to indicate the size of your organization based on an estimate of the number of employees currently employed.
|
||||
|
||||
> [!NOTE]
|
||||
> The **organization size** question is not related to how many licenses were purchased for your organization. It is used by the service to optimize the creation of the data cluster for your organization.
|
||||
|
||||
4. **Turn on preview features** <br> Learn about new features in the Microsoft Defender ATP preview release and be among the first to try upcoming features by turning on **Preview features**.
|
||||
|
||||
You'll have access to upcoming features which you can provide feedback on to help improve the overall experience before features are generally available.
|
||||
|
||||
- Toggle the setting between On and Off to choose **Preview features**.
|
||||
|
||||
> [!NOTE]
|
||||
> This option can be changed at a later time.
|
||||
|
||||
4. You will receive a warning notifying you that you won't be able to change some of your preferences once you click **Continue**.
|
||||
|
||||
> [!NOTE]
|
||||
> Some of these options can be changed at a later time in Microsoft Defender Security Center.
|
||||
|
||||
|
||||
|
||||
5. A dedicated cloud instance of Microsoft Defender Security Center is being created at this time. This step will take an average of 5 minutes to complete.
|
||||
|
||||
6. You are almost done. Before you can start using Microsoft Defender ATP you'll need to:
|
||||
|
||||
- [Onboard Windows 10 machines](configure-endpoints.md)
|
||||
|
||||
- Run detection test (optional)
|
||||
|
||||
|
||||
|
||||
> [!IMPORTANT]
|
||||
> If you click **Start using Microsoft Defender ATP** before onboarding machines you will receive the following notification:
|
||||
> 
|
||||
|
||||
7. After onboarding machines you can click **Start using Microsoft Defender ATP**. You will now launch Microsoft Defender ATP for the first time.
|
||||
|
||||
## Related topics
|
||||
- [Onboard machines to the Microsoft Defender Advanced Threat Protection service](onboard-configure.md)
|
||||
- [Troubleshoot onboarding process and portal access issues](troubleshoot-onboarding-error-messages.md)
|
||||
@ -1,6 +1,6 @@
|
||||
---
|
||||
title: Deploy Microsoft Defender ATP for Linux with Ansible
|
||||
ms.reviewer:
|
||||
ms.reviewer:
|
||||
description: Describes how to deploy Microsoft Defender ATP for Linux using Ansible.
|
||||
keywords: microsoft, defender, atp, linux, installation, deploy, uninstallation, puppet, ansible, linux, redhat, ubuntu, debian, sles, suse, centos
|
||||
search.product: eADQiWindows 10XVcnh
|
||||
@ -14,7 +14,7 @@ author: dansimp
|
||||
ms.localizationpriority: medium
|
||||
manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
---
|
||||
|
||||
@ -36,14 +36,14 @@ This topic describes how to deploy Microsoft Defender ATP for Linux using Ansibl
|
||||
Before you get started, please see [the main Microsoft Defender ATP for Linux page](microsoft-defender-atp-linux.md) for a description of prerequisites and system requirements for the current software version.
|
||||
|
||||
- Ansible needs to be installed on at least on one computer (we will call it the master).
|
||||
- Passwordless SSH must be configured for the root user between the master and all clients.
|
||||
- SSH must be configured for an administrator account between the master and all clients, and it is recommended be configured with public key authentication.
|
||||
- The following software must be installed on all clients:
|
||||
- Python-apt
|
||||
- Curl
|
||||
- Unzip
|
||||
- curl
|
||||
- python-apt
|
||||
- unzip
|
||||
|
||||
- All hosts must be listed in the following format in the `/etc/ansible/hosts` file:
|
||||
|
||||
|
||||
```bash
|
||||
[servers]
|
||||
host1 ansible_ssh_host=10.171.134.39
|
||||
@ -67,7 +67,7 @@ Download the onboarding package from Microsoft Defender Security Center:
|
||||
|
||||
|
||||
4. From a command prompt, verify that you have the file. Extract the contents of the archive:
|
||||
|
||||
|
||||
```bash
|
||||
$ ls -l
|
||||
total 8
|
||||
@ -79,12 +79,11 @@ Download the onboarding package from Microsoft Defender Security Center:
|
||||
|
||||
## Create Ansible YAML files
|
||||
|
||||
Create subtask or role files that contribute to an actual task. Create the following files under the `/etc/ansible/roles` directory.
|
||||
Create subtask or role files that contribute to an actual task. First create the `copy_onboarding_pkg.yml` file under the `/etc/ansible/roles` directory:
|
||||
|
||||
- Copy the onboarding package to all client machines:
|
||||
|
||||
```bash
|
||||
$ cat /etc/ansible/roles/copy_onboarding_pkg.yml
|
||||
- name: Copy the zip file
|
||||
copy:
|
||||
src: /root/WindowsDefenderATPOnboardingPackage.zip
|
||||
@ -92,29 +91,33 @@ Create subtask or role files that contribute to an actual task. Create the follo
|
||||
owner: root
|
||||
group: root
|
||||
mode: '0644'
|
||||
|
||||
- name: Add Microsoft apt signing key
|
||||
apt_key:
|
||||
url: https://packages.microsoft.com/keys/microsoft.asc
|
||||
state: present
|
||||
when: ansible_os_family == "Debian"
|
||||
```
|
||||
|
||||
- Create a `setup.sh` script that operates on the onboarding file:
|
||||
- Create the `setup.sh` script that operates on the onboarding file, in this example located in the `/root` directory:
|
||||
|
||||
```bash
|
||||
$ cat /root/setup.sh
|
||||
|
||||
#!/bin/bash
|
||||
|
||||
# We assume WindowsDefenderATPOnboardingPackage.zip is stored in /root
|
||||
cd /root || exit 1
|
||||
# Unzip the archive and create the onboarding file
|
||||
mkdir -p /etc/opt/microsoft/mdatp/
|
||||
unzip WindowsDefenderATPOnboardingPackage.zip
|
||||
cp mdatp_onboard.json /etc/opt/microsoft/mdatp/mdatp_onboard.json
|
||||
|
||||
# get the GPG key
|
||||
curl https://packages.microsoft.com/keys/microsoft.asc | gpg --dearmor > microsoft.gpg
|
||||
sudo mv microsoft.gpg /etc/apt/trusted.gpg.d/
|
||||
```
|
||||
|
||||
- Create the onboarding file:
|
||||
- Create the onboarding task, `onboarding_setup.yml`, under the `/etc/ansible/roles` directory:
|
||||
|
||||
```bash
|
||||
$ cat setup_blob.yml
|
||||
- name: Register mdatp_onboard.json
|
||||
stat: path=/etc/opt/microsoft/mdatp/mdatp_onboard.json
|
||||
register: mdatp_onboard
|
||||
|
||||
- name: Copy the setup script file
|
||||
copy:
|
||||
src: /root/setup.sh
|
||||
@ -124,7 +127,8 @@ Create subtask or role files that contribute to an actual task. Create the follo
|
||||
mode: '0744'
|
||||
|
||||
- name: Run a script to create the onboarding file
|
||||
script: /root/setup.sh
|
||||
script: /root/setup.sh
|
||||
when: not mdatp_onboard.stat.exists
|
||||
```
|
||||
|
||||
- Add the Microsoft Defender ATP repository and key.
|
||||
@ -142,28 +146,22 @@ Create subtask or role files that contribute to an actual task. Create the follo
|
||||
> [!NOTE]
|
||||
> In case of Oracle Linux, replace *[distro]* with “rhel”.
|
||||
|
||||
- For apt-based distributions use the following YAML file:
|
||||
|
||||
```bash
|
||||
$ cat add_apt_repo.yml
|
||||
- name: Add Microsoft repository for MDATP
|
||||
- name: Add Microsoft apt repository for MDATP
|
||||
apt_repository:
|
||||
repo: deb [arch=arm64,armhf,amd64] https://packages.microsoft.com/[distro]/[version]/prod [channel] main
|
||||
update_cache: yes
|
||||
state: present
|
||||
filename: microsoft-[channel].list
|
||||
when: ansible_os_family == "Debian"
|
||||
|
||||
- name: Add Microsoft APT key
|
||||
apt_key:
|
||||
keyserver: https://packages.microsoft.com/
|
||||
id: BC528686B50D79E339D3721CEB3E94ADBE1229C
|
||||
```
|
||||
apt_key:
|
||||
keyserver: https://packages.microsoft.com/
|
||||
id: BC528686B50D79E339D3721CEB3E94ADBE1229C
|
||||
when: ansible_os_family == "Debian"
|
||||
|
||||
- For yum-based distributions use the following YAML file:
|
||||
|
||||
```bash
|
||||
$ cat add_yum_repo.yml
|
||||
- name: Add Microsoft repository for MDATP
|
||||
- name: Add Microsoft yum repository for MDATP
|
||||
yum_repository:
|
||||
name: packages-microsoft-com-prod-[channel]
|
||||
description: Microsoft Defender ATP
|
||||
@ -171,6 +169,7 @@ Create subtask or role files that contribute to an actual task. Create the follo
|
||||
baseurl: https://packages.microsoft.com/[distro]/[version]/[channel]/
|
||||
gpgcheck: yes
|
||||
enabled: Yes
|
||||
when: ansible_os_family == "RedHat"
|
||||
```
|
||||
|
||||
- Create the actual install/uninstall YAML files under `/etc/ansible/playbooks`.
|
||||
|
||||
@ -27,6 +27,8 @@ Live response is a capability that gives you instantaneous access to a machine u
|
||||
|
||||
Live response is designed to enhance investigations by enabling you to collect forensic data, run scripts, send suspicious entities for analysis, remediate threats, and proactively hunt for emerging threats.
|
||||
|
||||
> [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4qLUW]
|
||||
|
||||
With live response, analysts will have the ability to:
|
||||
- Run basic and advanced commands to do investigative work
|
||||
- Download files such as malware samples and outcomes of PowerShell scripts
|
||||
|
||||
@ -26,6 +26,13 @@ ms.topic: conceptual
|
||||
>
|
||||
> If you have previously whitelisted the kernel extension as part of your remote deployment, that warning should not be presented to the end user. If you have not previously deployed a policy to whitelist the kernel extension, your users will be presented with the warning. To proactively silence the warning, you can still deploy a configuration to whitelist the kernel extension. Refer to the instructions in the [JAMF-based deployment](mac-install-with-jamf.md#approved-kernel-extension) and [Microsoft Intune-based deployment](mac-install-with-intune.md#create-system-configuration-profiles) topics.
|
||||
|
||||
## 100.86.92
|
||||
|
||||
- Improvements around compatibility with Time Machine
|
||||
- Addressed an issue where the product was sometimes not cleaning all files under `/Library/Application Support/Microsoft/Defender` during uninstallation
|
||||
- Reduced the CPU utilization of the product when Microsoft products are updated through Microsoft AutoUpdate
|
||||
- Other performance improvements & bug fixes
|
||||
|
||||
## 100.86.91
|
||||
|
||||
> [!CAUTION]
|
||||
|
||||
@ -34,6 +34,9 @@ Microsoft Cloud App Security (Cloud App Security) is a comprehensive solution th
|
||||
|
||||
Cloud App Security discovery relies on cloud traffic logs being forwarded to it from enterprise firewall and proxy servers. Microsoft Defender ATP integrates with Cloud App Security by collecting and forwarding all cloud app networking activities, providing unparalleled visibility to cloud app usage. The monitoring functionality is built into the device, providing complete coverage of network activity.
|
||||
|
||||
> [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4r4yQ]
|
||||
|
||||
|
||||
The integration provides the following major improvements to the existing Cloud App Security discovery:
|
||||
|
||||
- Available everywhere - Since the network activity is collected directly from the endpoint, it's available wherever the device is, on or off corporate network, as it's no longer depended on traffic routed through the enterprise firewall or proxy servers.
|
||||
|
||||
@ -59,7 +59,7 @@ Microsoft Defender ATP uses the following combination of technology built into W
|
||||
</tr>
|
||||
<tr>
|
||||
<td colspan="7">
|
||||
<a href="#apis"><center><b>Centratlized configuration and administration, APIs</a></b></center></td>
|
||||
<a href="#apis"><center><b>Centralized configuration and administration, APIs</a></b></center></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td colspan="7"><a href="#mtp"><center><b>Microsoft Threat Protection</a></center></b></td>
|
||||
|
||||
@ -28,11 +28,14 @@ Offboard machine from Microsoft Defender ATP.
|
||||
|
||||
|
||||
## Limitations
|
||||
1. Rate limitations for this API are 100 calls per minute and 1500 calls per hour.
|
||||
- Rate limitations for this API are 100 calls per minute and 1500 calls per hour.
|
||||
|
||||
|
||||
[!include[Machine actions note](../../includes/machineactionsnote.md)]
|
||||
|
||||
>[!Note]
|
||||
> This does not support offboarding macOS Devices.
|
||||
|
||||
## Permissions
|
||||
One of the following permissions is required to call this API. To learn more, including how to choose permissions, see [Use Microsoft Defender ATP APIs](apis-intro.md)
|
||||
|
||||
@ -83,4 +86,4 @@ Content-type: application/json
|
||||
{
|
||||
"Comment": "Offboard machine by automation"
|
||||
}
|
||||
```
|
||||
```
|
||||
|
||||
@ -29,6 +29,9 @@ ms.topic: article
|
||||
|
||||
Microsoft Defender ATP supports streaming all the events available through [Advanced Hunting](advanced-hunting-overview.md) to an [Event Hubs](https://docs.microsoft.com/azure/event-hubs/) and/or [Azure storage account](https://docs.microsoft.com/azure/event-hubs/).
|
||||
|
||||
> [!VIDEO https://www.microsoft.com/en-us/videoplayer/embed/RE4r4ga]
|
||||
|
||||
|
||||
## In this section
|
||||
|
||||
Topic | Description
|
||||
|
||||
@ -41,11 +41,11 @@ Each machine in the organization is scored based on three important factors to h
|
||||
|
||||
- **Business value** - Your organization's assets, critical processes, and intellectual properties
|
||||
|
||||
## Navigate to the security recommendations
|
||||
## Navigate to security recommendations
|
||||
|
||||
You can access security recommendations from the Microsoft Defender ATP Threat & Vulnerability Management menu, dashboard, software page, and machine page.
|
||||
|
||||
### Top security recommendations from the Threat & Vulnerability Management dashboard
|
||||
### Top security recommendations in the Threat & Vulnerability Management dashboard
|
||||
|
||||
In a given day as a Security Administrator, you can take a look at the [Threat & Vulnerability Management dashboard](tvm-dashboard-insights.md) to see your [exposure score](tvm-exposure-score.md) side-by-side with your [configuration score](configuration-score.md). The goal is to **lower** your organization's exposure from vulnerabilities, and **increase** your organization's security configuration to be more resilient against cybersecurity threat attacks. The top security recommendations list can help you achieve that goal.
|
||||
|
||||
@ -53,10 +53,12 @@ In a given day as a Security Administrator, you can take a look at the [Threat &
|
||||
|
||||
The top security recommendations lists the improvement opportunities prioritized based on the important factors mentioned in the previous section - threat, likelihood to be breached, and value. Selecting a recommendation will take you to the security recommendations page with more details about the recommendation.
|
||||
|
||||
### Security recommendations from the navigation menu
|
||||
### Navigation menu
|
||||
|
||||
Go to the Threat & Vulnerability Management navigation menu and select **Security recommendations** to open the list of security recommendations for the threats and vulnerabilities found in your organization.
|
||||
|
||||
## Security recommendations overview
|
||||
|
||||
You will be able to view the recommendation, the number of weaknesses found, related components, threat insights, number of exposed machines, status, remediation type, remediation activities, impact to your exposure and configuration scores, and associated tags.
|
||||
|
||||
The color of the **Exposed machines** graph changes as the trend changes. If the number of exposed machines is on the rise, the color changes into red. If there's a decrease in the amount of exposed machines, the color of the graph will change into green. This happens when the numbers on the right hand side is greater than what's on the left, which means an increase or decrease at the end of even a single machine will change the graph's color.
|
||||
@ -75,6 +77,9 @@ From the flyout, you can do any of the following:
|
||||
|
||||
- **Exception options** - Submit an exception, provide justification, and set exception duration if you can't remediate the issue just yet due to specific business reasons, compensation controls, or if it is a false positive.
|
||||
|
||||
>[!NOTE]
|
||||
>When a change is made on a machine, it may take up to two hours for the data to be reflected in the Microsoft Defender Security Center.
|
||||
|
||||
## Report inaccuracy
|
||||
|
||||
You can report a false positive when you see any vague, inaccurate, incomplete, or already remediated security recommendation information.
|
||||
|
||||
@ -24,10 +24,12 @@ ms.collection:
|
||||
|
||||
## What is shadow protection?
|
||||
|
||||
Shadow protection (currently in [limited private preview](#can-i-participate-in-the-private-preview-of-shadow-protection)) extends behavioral-based blocking and containment capabilities by blocking malicious artifacts or behaviors even if [Windows Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10) is not your active antivirus protection. If your organization has decided to use an antivirus solution other than Windows Defender Antivirus, you are still protected through shadow protection.
|
||||
When enabled, shadow protection extends behavioral-based blocking and containment capabilities by blocking malicious artifacts or behaviors observed through post-breach protection. This is the case even if [Windows Defender Antivirus](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/windows-defender-antivirus-in-windows-10) is not your active antivirus protection. Shadow protection is useful if your organization has not fully transitioned to Windows Defender Antivirus and you are presently using a third-party antivirus solution. Shadow protection works behind the scenes by remediating malicious entities identified in post-breach protection that the existing third-party antivirus solution missed.
|
||||
|
||||
> [!TIP]
|
||||
> To get the best protection, [deploy Microsoft Defender ATP baselines](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-machines-security-baseline). And see [Better together: Windows Defender Antivirus and Microsoft Defender Advanced Threat Protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus).
|
||||
> [!NOTE]
|
||||
> Shadow protection is currently in [limited private preview](#can-i-participate-in-the-private-preview-of-shadow-protection).
|
||||
|
||||
To get the best protection, [deploy Microsoft Defender ATP baselines](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/configure-machines-security-baseline). And see [Better together: Windows Defender Antivirus and Microsoft Defender Advanced Threat Protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/why-use-microsoft-antivirus).
|
||||
|
||||
## What happens when something is detected?
|
||||
|
||||
@ -39,6 +41,9 @@ The following images shows an instance of unwanted software that was detected an
|
||||
|
||||
## Turn on shadow protection
|
||||
|
||||
> [!IMPORTANT]
|
||||
> Make sure the [requirements](#requirements-for-shadow-protection) are met before turning shadow protection on.
|
||||
|
||||
1. Go to the Microsoft Defender Security Center ([https://securitycenter.windows.com](https://securitycenter.windows.com)) and sign in.
|
||||
|
||||
2. Choose **Settings** > **Advanced features**.
|
||||
@ -48,18 +53,18 @@ The following images shows an instance of unwanted software that was detected an
|
||||
3. Turn shadow protection on.
|
||||
|
||||
> [!NOTE]
|
||||
> Currently, shadow protection can be turned on only in the Microsoft Defender Security Center. You cannot use registry keys, Intune, or group policies to turn shadow protection on or off at this time.
|
||||
> Shadow protection can be turned on only in the Microsoft Defender Security Center. You cannot use registry keys, Intune, or group policies to turn shadow protection on or off.
|
||||
|
||||
## Requirements for shadow protection
|
||||
|
||||
|Requirement |Details |
|
||||
|---------|---------|
|
||||
|Permissions |One of the following roles should be assigned in [Azure Active Directory](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-users-assign-role-azure-portal): <br/>- Security Administrator or Global Administrator <br/>- Security Reader <br/>See [Basic permissions](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/basic-permissions). |
|
||||
|Permissions |Global Administrator or Security Administrator role assigned in [Azure Active Directory](https://docs.microsoft.com/azure/active-directory/fundamentals/active-directory-users-assign-role-azure-portal). See [Basic permissions](https://docs.microsoft.com/windows/security/threat-protection/microsoft-defender-atp/basic-permissions). |
|
||||
|Operating system |One of the following: <br/>- Windows 10 (all releases) <br/>- Windows Server 2016 or later |
|
||||
|Windows E5 enrollment |This is included in the following subscriptions: <br/>- Microsoft 365 E5 <br/>- Microsoft 365 E3 together with the Identity & Threat Protection offering <br/>See [Components](https://docs.microsoft.com/microsoft-365/enterprise/microsoft-365-overview?view=o365-worldwide#components) and [Features and capabilities for each plan](https://www.microsoft.com/microsoft-365/compare-all-microsoft-365-plans). |
|
||||
|Cloud-delivered protection |Make sure Windows Defender Antivirus is configured such that cloud-delivered protection is enabled. <br/>See [Enable cloud-delivered protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/enable-cloud-protection-windows-defender-antivirus). |
|
||||
|Windows Defender Antivirus antimalware client |To make sure your client is up to date, using PowerShell, run the `Get-MpComputerStatus` cmdlet as an administrator. In the **AMProductVersion** line, you should see **4.18.2001.10** or above. |
|
||||
|Windows Defender Antivirus engine |To make sure your engine is up to date, using PowerShell, run the `Get-MpComputerStatus` cmdlet as an administrator. In the **AMEngineVersion** line, you should see **1.1.16700.2** or above. |
|
||||
|Windows Defender Antivirus antimalware client |To make sure your client is up to date, using PowerShell, run the [Get-MpComputerStatus](https://docs.microsoft.com/powershell/module/defender/get-mpcomputerstatus?view=win10-ps) cmdlet as an administrator. In the **AMProductVersion** line, you should see **4.18.2001.10** or above. |
|
||||
|Windows Defender Antivirus engine |To make sure your engine is up to date, using PowerShell, run the [Get-MpComputerStatus](https://docs.microsoft.com/powershell/module/defender/get-mpcomputerstatus?view=win10-ps) cmdlet as an administrator. In the **AMEngineVersion** line, you should see **1.1.16700.2** or above. |
|
||||
|
||||
> [!IMPORTANT]
|
||||
> To get the best protection value, make sure Windows Defender Antivirus is configured to receive regular updates and other essential features, such as behavioral monitoring, IOfficeAV, tamper protection, and more. See [Protect security settings with tamper protection](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection)
|
||||
|
||||
@ -21,23 +21,24 @@
|
||||
### [Audit WDAC policies](audit-windows-defender-application-control-policies.md)
|
||||
### [Merge WDAC policies](merge-windows-defender-application-control-policies.md)
|
||||
### [Enforce WDAC policies](enforce-windows-defender-application-control-policies.md)
|
||||
### [Allow COM object registration](allow-com-object-registration-in-windows-defender-application-control-policy.md)
|
||||
### [Deploy WDAC policies using Group Policy](deploy-windows-defender-application-control-policies-using-group-policy.md)
|
||||
### [Deploy WDAC policies using Intune](deploy-windows-defender-application-control-policies-using-intune.md)
|
||||
### [Allow COM object registration](allow-com-object-registration-in-windows-defender-application-control-policy.md)
|
||||
### [Use WDAC with .NET hardening](use-windows-defender-application-control-with-dynamic-code-security.md)
|
||||
### [Query WDAC events with Advanced hunting](querying-application-control-events-centrally-using-advanced-hunting.md)
|
||||
### [Manage packaged apps with WDAC](manage-packaged-apps-with-windows-defender-application-control.md)
|
||||
### [Use a Windows Defender Application Control policy to control specific plug-ins, add-ins, and modules](use-windows-defender-application-control-policy-to-control-specific-plug-ins-add-ins-and-modules.md)
|
||||
### [Use code signing to simplify application control for classic Windows applications](use-code-signing-to-simplify-application-control-for-classic-windows-applications.md)
|
||||
#### [Optional: Use the Device Guard Signing Portal in the Microsoft Store for Business](use-device-guard-signing-portal-in-microsoft-store-for-business.md)
|
||||
#### [Optional: Create a code signing cert for WDAC](create-code-signing-cert-for-windows-defender-application-control.md)
|
||||
#### [Deploy catalog files to support WDAC](deploy-catalog-files-to-support-windows-defender-application-control.md)
|
||||
### [Manage packaged apps with WDAC](manage-packaged-apps-with-windows-defender-application-control.md)
|
||||
### [Use a Windows Defender Application Control policy to control specific plug-ins, add-ins, and modules](use-windows-defender-application-control-policy-to-control-specific-plug-ins-add-ins-and-modules.md)
|
||||
### [Use signed policies to protect Windows Defender Application Control against tampering](use-signed-policies-to-protect-windows-defender-application-control-against-tampering.md)
|
||||
#### [Signing WDAC policies with SignTool.exe](signing-policies-with-signtool.md)
|
||||
### [Disable WDAC policies](disable-windows-defender-application-control-policies.md)
|
||||
### [LOB Win32 Apps on S Mode](LOB-win32-apps-on-s.md)
|
||||
|
||||
|
||||
## [Windows Defender Application Control operational guide](windows-defender-application-control-operational-guide.md)
|
||||
### [Understanding Application Control events](event-id-explanations.md)
|
||||
### [Query WDAC events with Advanced hunting](querying-application-control-events-centrally-using-advanced-hunting.md)
|
||||
|
||||
## [AppLocker](applocker\applocker-overview.md)
|
||||
### [Administer AppLocker](applocker\administer-applocker.md)
|
||||
|
||||
@ -0,0 +1,80 @@
|
||||
---
|
||||
title: Understanding Application Control events (Windows 10)
|
||||
description: Learn what different Windows Defender Application Control events signify.
|
||||
keywords: whitelisting, security, malware
|
||||
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
author: jsuther1974
|
||||
ms.reviewer: isbrahm
|
||||
ms.author: dansimp
|
||||
manager: dansimp
|
||||
ms.date: 3/17/2020
|
||||
---
|
||||
|
||||
# Understanding Application Control events
|
||||
|
||||
A Windows Defender Application Control (WDAC) policy logs events locally in Windows Event Viewer in either enforced or audit mode. These events are generated under two locations:
|
||||
|
||||
1. Event IDs beginning with 30 appear in Applications and Services logs – Microsoft – Windows – CodeIntegrity – Operational
|
||||
2. Event IDs beginning with 80 appear in Applications and Services logs – Microsoft – Windows – AppLocker – MSI and Script
|
||||
|
||||
## Microsoft Windows CodeIntegrity Operational log event IDs
|
||||
|
||||
| Event ID | Explanation |
|
||||
|----------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| 3076 | Audit executable/dll file |
|
||||
| 3077 | Block executable/dll file |
|
||||
| 3089 | Signing information event correlated with either a 3076 or 3077 event. One 3089 event is generated for each signature of a file. Contains the total number of signatures on a file and an index as to which signature it is.<br>Unsigned files will generate a single 3089 event with TotalSignatureCount 0. Correlated in the “System” portion of the event data under “Correlation ActivityID”. |
|
||||
| 3099 | Indicates that a policy has been loaded |
|
||||
|
||||
## Microsoft Windows Applocker MSI and Script log event IDs
|
||||
|
||||
| Event ID | Explanation |
|
||||
|----------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| 8028 | Audit script/MSI file generated by Windows LockDown Policy (WLDP) being called by the scripthosts themselves. Note: there is no WDAC enforcement on 3rd party scripthosts. |
|
||||
| 8029 | Block script/MSI file |
|
||||
| 8038 | Signing information event correlated with either a 8028 or 8029 event. One 8038 event is generated for each signature of a script file. Contains the total number of signatures on a script file and an index as to which signature it is. Unsigned script files will generate a single 8038 event with TotalSignatureCount 0. Correlated in the “System” portion of the event data under “Correlation ActivityID”. | |
|
||||
|
||||
## Optional Intelligent Security Graph (ISG) or Managed Installer (MI) diagnostic events
|
||||
|
||||
If either the ISG or MI is enabled in a WDAC policy, you can optionally choose to enable 3090, 3091, and 3092 events to provide additional diagnostic information.
|
||||
|
||||
| Event ID | Explanation |
|
||||
|----------|-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| 3090 | Allow executable/dll file |
|
||||
| 3091 | Audit executable/dll file |
|
||||
| 3092 | Block executable/dll file |
|
||||
|
||||
3090, 3091, and 3092 events are generated based on the status code of whether a binary passed the policy, regardless of what reputation it was given or whether it was allowed by a designated MI. The SmartLocker template which appears in the event should indicate why the binary passed/failed. Only one event is generated per binary pass/fail. If both ISG and MI are disabled, 3090, 3091, and 3092 events will not be generated.
|
||||
|
||||
### SmartLocker template
|
||||
|
||||
Below are the fields which help to diagnose what a 3090, 3091, or 3092 event indicates.
|
||||
|
||||
| Name | Explanation |
|
||||
|-------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
|
||||
| StatusCode | STATUS_SUCCESS indicates a binary passed the active WDAC policies. If so, a 3090 event is generated. If not, a 3091 event is generated if the blocking policy is in audit mode, and a 3092 event is generated if the policy is in enforce mode. |
|
||||
| ManagedInstallerEnabled | Policy trusts a MI |
|
||||
| PassesManagedInstaller | File originated from a trusted MI |
|
||||
| SmartlockerEnabled | Policy trusts the ISG |
|
||||
| PassesSmartlocker | File had positive reputation |
|
||||
| AuditEnabled | True if the policy is in audit mode, otherwise it is in enforce mode |
|
||||
|
||||
### Enabling ISG and MI diagnostic events
|
||||
|
||||
In order to enable 3091 audit events and 3092 block events, you must create a TestFlags regkey with a value of 0x100. You can do so using the following PowerShell command:
|
||||
|
||||
```powershell
|
||||
reg add hklm\system\currentcontrolset\control\ci -v TestFlags -t REG_DWORD -d 0x100
|
||||
```
|
||||
In order to enable 3090 allow events, you must create a TestFlags regkey with a value of 0x300. You can do so using the following PowerShell command:
|
||||
|
||||
```powershell
|
||||
reg add hklm\system\currentcontrolset\control\ci -v TestFlags -t REG_DWORD -d 0x300
|
||||
```
|
||||
@ -1,91 +0,0 @@
|
||||
---
|
||||
title: Signing Windows Defender Application Control policies with SignTool.exe (Windows 10)
|
||||
description: SSigned WDAC policies give organizations the highest level of malware protection available in Windows 10.
|
||||
keywords: whitelisting, security, malware
|
||||
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
author: jsuther1974
|
||||
ms.reviewer: isbrahm
|
||||
ms.author: dansimp
|
||||
manager: dansimp
|
||||
ms.date: 02/21/2018
|
||||
---
|
||||
|
||||
# Signing Windows Defender Application Control policies with SignTool.exe
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Windows 10
|
||||
- Windows Server 2016
|
||||
|
||||
Signed WDAC policies give organizations the highest level of malware protection available in Windows 10.
|
||||
In addition to their enforced policy rules, signed policies cannot be modified or deleted by a user or administrator on the computer.
|
||||
These policies are designed to prevent administrative tampering and kernel mode exploit access.
|
||||
With this in mind, it is much more difficult to remove signed WDAC policies.
|
||||
Before you sign and deploy a signed WDAC policy, we recommend that you [audit the policy](audit-windows-defender-application-control-policies.md) to discover any blocked applications that should be allowed to run.
|
||||
|
||||
Signing WDAC policies by using an on-premises CA-generated certificate or a purchased code signing certificate is straightforward.
|
||||
If you do not currently have a code signing certificate exported in .pfx format (containing private keys, extensions, and root certificates), see [Optional: Create a code signing certificate for Windows Defender Application Control](create-code-signing-cert-for-windows-defender-application-control.md) to create one with your on-premises CA.
|
||||
|
||||
Before signing WDAC policies for the first time, be sure to enable rule options 9 (“Advanced Boot Options Menu”) and 10 (“Boot Audit on Failure”) to leave troubleshooting options available to administrators. To ensure that a rule option is enabled, you can run a command such as `Set-RuleOption -FilePath <PathAndFilename> -Option 9` even if you're not sure whether the option is already enabled—if so, the command has no effect. When validated and ready for enterprise deployment, you can remove these options. For more information about rule options, see [Windows Defender Application Control policy rules](select-types-of-rules-to-create.md).
|
||||
|
||||
To sign a WDAC policy with SignTool.exe, you need the following components:
|
||||
|
||||
- SignTool.exe, found in the Windows SDK (Windows 7 or later)
|
||||
|
||||
- The binary format of the WDAC policy that you generated in the [Create a Windows Defender Application Control policy from a reference computer](create-initial-default-policy.md) section or another WDAC policy that you have created
|
||||
|
||||
- An internal CA code signing certificate or a purchased code signing certificate
|
||||
|
||||
If you do not have a code signing certificate, see the [Optional: Create a code signing certificate for Windows Defender Application Control](create-code-signing-cert-for-windows-defender-application-control.md) section for instructions on how to create one. If you use an alternate certificate or WDAC policy, be sure to update the following steps with the appropriate variables and certificate so that the commands will function properly. To sign the existing WDAC policy, copy each of the following commands into an elevated Windows PowerShell session:
|
||||
|
||||
1. Initialize the variables that will be used:
|
||||
|
||||
`$CIPolicyPath=$env:userprofile+"\Desktop\"`
|
||||
|
||||
`$InitialCIPolicy=$CIPolicyPath+"InitialScan.xml"`
|
||||
|
||||
`$CIPolicyBin=$CIPolicyPath+"DeviceGuardPolicy.bin"`
|
||||
|
||||
> [!NOTE]
|
||||
> This example uses the WDAC policy that you created in [Create a Windows Defender Application Control policy from a reference computer](create-initial-default-policy.md). If you are signing another policy, be sure to update the **$CIPolicyPath** and **$CIPolicyBin** variables with the correct information.
|
||||
|
||||
2. Import the .pfx code signing certificate. Import the code signing certificate that you will use to sign the WDAC policy into the signing user’s personal store on the computer that will be doing the signing. In this example, you use the certificate that was created in [Optional: Create a code signing certificate for Windows Defender Application Control](create-code-signing-cert-for-windows-defender-application-control.md).
|
||||
|
||||
3. Export the .cer code signing certificate. After the code signing certificate has been imported, export the .cer version to your desktop. This version will be added to the policy so that it can be updated later.
|
||||
|
||||
4. Navigate to your desktop as the working directory:
|
||||
|
||||
`cd $env:USERPROFILE\Desktop`
|
||||
|
||||
5. Use [Add-SignerRule](https://docs.microsoft.com/powershell/module/configci/add-signerrule) to add an update signer certificate to the WDAC policy:
|
||||
|
||||
`Add-SignerRule -FilePath $InitialCIPolicy -CertificatePath <Path to exported .cer certificate> -Kernel -User –Update`
|
||||
|
||||
> [!NOTE]
|
||||
> \<Path to exported .cer certificate> should be the full path to the certificate that you exported in step 3.
|
||||
Also, adding update signers is crucial to being able to modify or disable this policy in the future.
|
||||
|
||||
6. Use [Set-RuleOption](https://docs.microsoft.com/powershell/module/configci/set-ruleoption) to remove the unsigned policy rule option:
|
||||
|
||||
`Set-RuleOption -FilePath $InitialCIPolicy -Option 6 -Delete`
|
||||
|
||||
7. Use [ConvertFrom-CIPolicy](https://docs.microsoft.com/powershell/module/configci/convertfrom-cipolicy) to convert the policy to binary format:
|
||||
|
||||
`ConvertFrom-CIPolicy $InitialCIPolicy $CIPolicyBin`
|
||||
|
||||
8. Sign the WDAC policy by using SignTool.exe:
|
||||
|
||||
`<Path to signtool.exe> sign -v /n "ContosoDGSigningCert" -p7 . -p7co 1.3.6.1.4.1.311.79.1 -fd sha256 $CIPolicyBin`
|
||||
|
||||
> [!NOTE]
|
||||
> The *<Path to signtool.exe>* variable should be the full path to the SignTool.exe utility. **ContosoDGSigningCert** is the subject name of the certificate that will be used to sign the WDAC policy. You should import this certificate to your personal certificate store on the computer you use to sign the policy.
|
||||
|
||||
9. Validate the signed file. When complete, the commands should output a signed policy file called DeviceGuardPolicy.bin.p7 to your desktop. You can deploy this file the same way you deploy an enforced or non-enforced policy. For information about how to deploy WDAC policies, see [Deploy and manage Windows Defender Application Control with Group Policy](deploy-windows-defender-application-control-policies-using-group-policy.md).
|
||||
|
||||
@ -28,10 +28,8 @@ ms.date: 05/03/2018
|
||||
- Windows Server 2016
|
||||
|
||||
|
||||
Signed WDAC policies give organizations the highest level of malware protection available in Windows 10.
|
||||
In addition to their enforced policy rules, signed policies cannot be modified or deleted by a user or administrator on the computer.
|
||||
These policies are designed to prevent administrative tampering and kernel mode exploit access.
|
||||
With this in mind, it is much more difficult to remove signed WDAC policies.
|
||||
Signed WDAC policies give organizations the highest level of malware protection available in Windows 10. In addition to their enforced policy rules, signed policies cannot be modified or deleted by a user or administrator on the computer. These policies are designed to prevent administrative tampering and kernel mode exploit access. With this in mind, it is much more difficult to remove signed WDAC policies. Note that SecureBoot must be enabled in order to restrict users from updating or removing signed WDAC policies.
|
||||
|
||||
Before you sign and deploy a signed WDAC policy, we recommend that you [audit the policy](audit-windows-defender-application-control-policies.md) to discover any blocked applications that should be allowed to run.
|
||||
|
||||
Signing WDAC policies by using an on-premises CA-generated certificate or a purchased code signing certificate is straightforward.
|
||||
|
||||
@ -0,0 +1,42 @@
|
||||
---
|
||||
title: Managing and troubleshooting Windows Defender Application Control policies (Windows 10)
|
||||
description: Gather information about how your deployed Windows Defender Application Control policies are behaving.
|
||||
keywords: whitelisting, security, malware
|
||||
ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb
|
||||
ms.prod: w10
|
||||
ms.mktglfcycl: deploy
|
||||
ms.sitesec: library
|
||||
ms.pagetype: security
|
||||
ms.localizationpriority: medium
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
author: jsuther1974
|
||||
ms.reviewer: isbrahm
|
||||
ms.author: dansimp
|
||||
manager: dansimp
|
||||
ms.date: 03/16/2020
|
||||
---
|
||||
|
||||
# Windows Defender Application Control operational guide
|
||||
|
||||
**Applies to**
|
||||
- Windows 10
|
||||
- Windows Server 2016
|
||||
|
||||
After designing and deploying your Windows Defender Application Control (WDAC) policies, this guide covers understanding the effects your policies are having and troubleshooting when they are not behaving as expected. It contains information on where to find events and what they mean, and also querying these events with Microsoft Defender Advanted Threat Protection (MDATP) Advanced Hunting feature.
|
||||
|
||||
## WDAC Events Overview
|
||||
|
||||
WDAC generates and logs events when a policy is loaded as well as when a binary attempts to execute and is blocked. These events include information that identifies the policy and gives more details about the block. Generally, WDAC does not generate events when a binary is allowed; however, there is the option to enable allow events when Managed Installer and/or the Intelligent Security Graph (ISG) is configured.
|
||||
|
||||
WDAC events are generated under two locations:
|
||||
|
||||
1. Applications and Services logs – Microsoft – Windows – CodeIntegrity – Operational
|
||||
2. Applications and Services logs – Microsoft – Windows – AppLocker – MSI and Script
|
||||
|
||||
## In this section
|
||||
|
||||
| Topic | Description |
|
||||
| - | - |
|
||||
| [Understanding Application Control events](event-id-explanations.md) | This topic explains the meaning of different WDAC events. |
|
||||
| [Query WDAC events with Advanced hunting](querying-application-control-events-centrally-using-advanced-hunting.md) | This topic covers how to view WDAC events centrally from all systems that are connected to Microsoft Defender ATP. |
|
||||
Reference in New Issue
Block a user